StasonJatham
e8f7d6bfdf
Single stateless Go process that consumes CT logs via embedded (patched) CertSpotter internals, classifies cloud/database/storage DNS identifiers in-process with a zero-allocation classifier, enriches via round-robin DNS resolvers with CNAME following, and batch-writes useful findings to PostgreSQL. - third_party/certspotter: 2-hunk IdentifierSink patch, no stdout/JSON/files - internal/classify: AWS/Azure/GCP/Firebase/Cloudflare R2/DigitalOcean/Supabase/OCI - internal/dns: sharded bounded TTL cache, multi-resolver load balancing + failover - internal/pipeline: bounded queues, dedup, direct-priority load shedding - internal/store: pgx batch writer, Postgres CT checkpoints (no cert contents) - internal/probe: optional non-destructive reachability checks (off by default) - Docker: distroless non-root, read-only rootfs, no app volume, resource limits - tests enforce 0 allocs/op on the classifier and sink hot path
17 lines
498 B
Bash
17 lines
498 B
Bash
# Copy to .env and edit. .env is gitignored.
|
|
|
|
POSTGRES_USER=ctcloud
|
|
POSTGRES_PASSWORD=change-me-strong
|
|
POSTGRES_DB=ctcloud
|
|
|
|
# Local compose (private bridge network, no TLS):
|
|
DATABASE_URL=postgres://ctcloud:change-me-strong@postgres:5432/ctcloud?sslmode=disable
|
|
|
|
# Production: use a TLS-enabled database instead, e.g.
|
|
# DATABASE_URL=postgres://user:[email protected]:5432/ctcloud?sslmode=verify-full
|
|
|
|
DNS_SERVERS=1.1.1.1:53,8.8.8.8:53,1.0.0.1:53
|
|
DNS_WORKERS=16
|
|
LOG_LEVEL=info
|
|
ACTIVE_PROBING=false
|